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- The MAILING DA TE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



MONTH(S) FROM 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE _ 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

• If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

Responsive to communication(s) filed on )}jtoj &V+ 
2a)S This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) [XJ/£laim(s) K^2l is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^yt\a\rr\{s)lzk2^ is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2.D Certified copies of the priority documents have been received in Application No. . 



3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 
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DETAILED ACTION 
Response to Amendment 

1 . The examiner has noted that applicant has made a bona fide attempt to advance 
the application and is substantially a compete response to every rejection and objection, 
but contains several deficiencies such as: not amending and not listing the status of 
claims which are also now being presented as "previously presented", see claims 15 
and 25. However, since the new claims are believed to be an attempt to enter the 
previously non entered claims after final and the office action is a reiteration of the 
previous one that encompasses such claims they are being considered. 

2. Applicant is reminded that an apparatus must be distinguished from the prior art 
in terms of structure rather that function. Additionally, with respect to the manner in 
which a claimed apparatus is intended to be used, it does not differentiate from a prior 
art apparatus. See MPEP 21 14. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351 (a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 
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3. Claims 1-32 are rejected under 35 U.S.C. 102(e) as being anticipated by US 
patent application, number 2002/0035683 A1 , Kaashoek et al., hereinafter '683. 

The applied reference has a common inventor with the instant application. 
Based upon the earlier effective U.S. filing date of the reference, it constitutes prior art 
under 35 U.S.C. 102(e). This rejection under 35 U.S.C. 102(e) might be overcome 
either by a showing under 37 CFR 1.132 that any invention disclosed but not claimed in 
the reference was derived from the inventor of this application and is thus not the 
invention "by another," or by an appropriate showing under 37 CFR 1.131. 

As to claims 1-25, '683 teach the claimed invention having: a monitoring 
device/gateway, a plurality of probes/data collectors of gateway, collecting statistical 
information, a data center, network, joining, victim data center, cluster head (collectively 
27, 33), hardened interface (30), install filters, determining a denial of service attack, 
communication, deployed inline and out of line, dedicated/private network (see abs., 
background, summary, figs. 1-4, 5-6, 9, and cols. 1-5 et seq.). 

As to claims 26-32, '683 teach probes coupled between network and a data 
center, scaleable/dynamic/redundant probes/filters/data collectors, randomly monitored 
packets, over a link. See '683 at abs., fig. 2 (30, 38), fig. 3 (30, 20, peering point), col. 
1, par. 0020, col. 2, par. 0026-0030 et seq., 0032-0034, elms 1,4, 6-9, 12-14, 17, 21, 
and 27. 

4. Similarly, claims 1-32 are rejected under 35 U.S.C. 102(e) as being anticipated 
by U.S. 2002/0032774 A1, see disclosure. 



Application/Control Number: 1 0/062,974 Page 4 

Art Unit: 2134 

The applied reference has a common inventor with the instant application. Based upon 
the earlier effective U.S. filing date of the reference, it constitutes prior art under 35 
U.S.C. 102(e). This rejection under 35 U.S.C. 102(e) might be overcome either by a 
showing under 37 CFR 1.132 that any invention disclosed but not claimed in the 
reference was derived from the inventor of this application and is thus not the invention 
"by another," or by an appropriate showing under 37 CFR 1 .131. 

As to claims 1-25, '774 teach the claimed invention having: a monitoring 
device/gateway, a plurality of probes/data collectors of gateway, collecting statistical 
information, a data center, network, joining, victim data center, cluster head (collectively 
27, 33), hardened interface (30), install filters, determining a denial of service attack, 
communication, deployed inline and out of line, dedicated/private network (see abs., 
background, summary, figs. 1-4, 5-6, 9, and cols. 1-5 et seq.). 

As to claims 26-32, 774 teach probes coupled between network and a data 
center, scaleable/dynamic/redundant probes/filters/data collectors, randomly monitored 
packets, over a link. See '774 at abs., fig. 2 (30, 38), fig. 3 (30, 20, peering point), col. 
1, par. 0022, col. 2, par. 0028-0032 et seq., 0034-0036, elms. 1,4, 6-9, 12. 
5. Similarly, claims 1-32 are rejected under 35 U.S.C. 102(e) as being anticipated 
by U.S. 2002/0032880 A1. See disclosure. 

The applied reference has a common inventor with the instant application. 
Based upon the earlier effective U.S. filing date of the reference, it constitutes prior art 
under 35 U.S.C. 102(e). This rejection under 35 U.S.C. 102(e) might be overcome 
either by a showing under 37 CFR 1.132 that any invention disclosed but not claimed in 



Application/Control Number: 10/062,974 Page 5 

Art Unit: 2134 

the reference was derived from the inventor of this application and is thus not the 
invention "by another," or by an appropriate showing under 37 CFR 1 .131 . 

As to claims 1-25, '880 teach the claimed invention having: a monitoring 
device/gateway, a plurality of probes/data collectors of gateway, collecting statistical 
information, a data center, network, joining, victim data center, cluster head (collectively 
27, 33), hardened interface (30), install filters, determining a denial of service attack, 
communication, deployed inline and out of line, dedicated/private network (see abs., 
background, summary, figs. 1-4, 5-6, 9, and cols. 1-5 et seq.). 

As to claims 26-32, '880 teach probes coupled between network and a data 
center, scaleable/dynamic/redundant probes/filters/data collectors, randomly monitored 
packets, over a link. See '880 at abs., fig. 2 (30, 38), fig. 3 (30, 20, peering point), col. 
1, par. 0021, col. 2, par. 0025-0031 et seq., 0032-0035, elms. 1,4, 9. 



Double Patenting 

A rejection based on double patenting of the "same invention" type finds its 
support in the language of 35 U.S.C. 101 which states that "whoever invents or 
discovers any new and useful process ... may obtain a patent therefor ..." (Emphasis 
added). Thus, the term "same invention," in this context, means an invention drawn to 
identical subject matter. See Miller v. Eagle Mfg. Co., 151 U.S. 186 (1894); In re 
Ockert, 245 F.2d 467, 114 USPQ 330 (CCPA 1957); and In re Vogel, 422 F.2d 438, 164 
USPQ 619 (CCPA 1970). 

A statutory type (35 U.S.C. 101) double patenting rejection can be overcome by 
canceling or amending the conflicting claims so they are no longer coextensive in 
scope. The filing of a terminal disclaimer cannot overcome a double patenting rejection 
based upon 35 U.S.C. 101. x . 

6. Claims 1,4, 8-10, 13, and 16, are provisionally rejected under 35 U.S.C. 101 as 



claiming the same invention as that of claims 1 , 3-4, 6-8, 12-15, 17,and 26-27 of 
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copending Application No. US 2002/0035683 A1, hereinafter '683. This is a provisional 
double patenting rejection since the conflicting claims have not in fact been patented. 
7. Alternatively, claims 1, 4, 8-10, 13, and 16, are provisionally rejected under the 
judicially created doctrine of obviousness-type double patenting as being unpatentable 
over claiml, 3-4, 6-8, 12-15, 17,and 26-27 of copending Application No. US 
2002/0035683 A1, hereinafter '683. Although the conflicting claims are not identical, 
they are not patentably distinct from each other because, the monitoring devices and/or 
probe or plurality of probes devices are monitors that are statistical collectors in both 
applications. Similarly, the cluster heads are in fact the controllers/centers for the 
monitor/probes in both applications. It would have been obvious to one of ordinary skill 
in the art at the time of the invention to modify the invention of US application '683, by 
labeling the cluster heads as controllers/centers, and the probe devices/monitors as 
statistical collectors/monitors as recited in the disclosure. One of ordinary skill in the art 
would have been motivated to perform such a modification because it involves only the 
aspect of labeling the functions of the device and not modifying its structure. One of 
ordinary skill in the art would have seen this as an obvious expedient to renaming the 
function of the device/apparatus/system, while retaining the original functions. 

Response to Arguments 

Applicant's arguments filed 12/22/04 have been fully considered but they are not 
persuasive. Applicant remarks that the prior arts fail to teach a number of features: 
such as a cluster head, links different network that is being monitored/victim center or 
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networks, packets transmitted over links, and additionally the previously features of a 
monitoring device, a plurality of probes collecting statistical information from data 
packets on a network, cluster heads coupled to said probes, and determining whether 
there is a denial of service attack on the data center. The examiner does not concur, 
applicant is reminded that the cluster head to which he is purporting that there is a 
structural difference has been depicted as a black box of figure 3. It appears to be a 
programming element that is part of a gateway and performing data monitoring 
functions that a gateway performs. The distinction that applicant is purporting does not 
appear to exists. Additionally, distinctions of querying and pushing information to and 
from a cluster monitor is not recited in the claims, and is therefore moot whether or not 
the art teaches it. The aspects of a redundant network is also taught in the prior art, see 
your remarks on page 9, regarding the publications and its functionality. Likewise, the 
probes being disposed to collect statistical information, is precisely the function that 
probes perform on data packets. The examiner would like to indicate that the two 
networks in which the inventions are to be used, '974 and the prior art are structurally 
the identical. Therefore, an identical device is inherently capable of performing the 
same functions, regardless of what the devices are labeled. See figures 1-3, 5-6 and 
par. 0020-21 et seq. of '880, and present disclosure '974. Additionally, the monitoring 
device of '974 (element 26) is a gateway, see also pg. 3, lines 20-21. Similarly, monitor 
of '880 is a gateway (element 26), and col. 2, par. 0022. The probes (26a-26n) of '974, 
which are a part of the gateway (26), perform the functions of sampling packets and 
collecting statistical information of packets (fig. 2, pg. 7, lines 10 et seq.); similarly, see 
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'880 at col. 2, par. 0023. The clustered heads of '974 are connected to the probes (pg. 

7, lines 2 et seq.), similarly, figs. 1-3, 6, and col. 2 f par. 0030 et seq.. As to the remarks 
that the instant invention '974 and the prior art are germane to different inventions the 
examiner does not concur. Both the instant application and the prior art recites 
inventions that may be utilized in a distributed environment for the detection of a denial 
of service attack, see above. 

Conclusion 

8. This is a RCE of applicant's earlier Application No. 10/062,974. All claims are 
drawn to the same invention claimed in the earlier application and could have been 
finally rejected on the grounds and art of record in the next Office action if they had 
been entered in the earlier application. Accordingly, THIS ACTION IS MADE FINAL 
even though it is a first action in this case. See MPEP § 706.07(b). Applicant is 
reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no, however, event will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Norman M. Wright whose telephone number is (703) 
305-9586. The examiner can normally be reached on 5/4/9 compressed week. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Greg Morse can be reached on (703) 308-4789. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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